Sub-processors

2.1. The infrastructure on which all clinic and patient data is hosted:

• Application server and database hosting — Netinternet Bilişim Teknolojileri A.Ş. (Türkiye); data centre in Denizli, within Türkiye. Data processed: all clinic and patient data (patient files pass through this server and are stored in the object storage below), encrypted database backups. Safeguard: the data is processed in Türkiye, so this service involves no transfer abroad within the meaning of Article 9 KVKK; a written data processing agreement with the provider under Article 12 KVKK, whose signature date is published in this line. For clinics in the European Economic Area: the transfer to Türkiye is made under the Standard Contractual Clauses in Annex 4 of the Data Processing Agreement.
• Object storage for patient files, clinic logos and staff photos (private bucket) and the second copy of the encrypted database backups — Cloudflare, Inc. (US-based; patient files in data centres in the European Union jurisdiction; the backup copy is encrypted so that it can be opened only with Clinigim’s key). Data processed: documents and images uploaded for patients, clinic logos and staff photos, a second copy of the encrypted database backups. Transfer route from Türkiye: the standard contract published by the Board under Article 9(4)(c) KVKK (processor to processor) and notification to the Authority; the completion date is published in this line. For clinics in the European Economic Area: the Standard Contractual Clauses adopted by European Commission Decision (EU) 2021/914.
• Domain, static site hosting and network protection — Cloudflare, Inc. (US; global network). Data processed: the site’s static files and request metadata (IP address, time, requested address); this data reaches the provider directly from the visitor’s device. Requests to the application server do not pass through this network; Clinigim sends no patient data to the provider through the domain and static site service (patient files are kept only in the object storage service above). As Clinigim makes no transfer from Türkiye abroad through this service, no Article 9 KVKK safeguard is required; safeguard: a written data processing agreement with the provider; for clinics in the European Economic Area, the Standard Contractual Clauses.

3.1. Providers used to deliver messages and notifications; messaging channels are used only when the clinic switches the feature on:

• Transactional e-mail (verification codes, account and subscription notices, and confirmation e-mails for appointments booked through clinics’ booking pages) — Netlen İnternet Hizmetleri Ltd. Şti. (Türkiye; MailGuard e-mail delivery service, servers within Türkiye). Data processed: recipient e-mail address, name, message content. Safeguard: the data is processed in Türkiye, so this service involves no transfer abroad within the meaning of Article 9 KVKK; a written data processing agreement with the provider under Article 12 KVKK, whose signature date is published in this line. For clinics in the European Economic Area: the transfer to Türkiye is made under the Standard Contractual Clauses in Annex 4 of the Data Processing Agreement.
• WhatsApp reminder messages — Twilio Inc. (US) messaging infrastructure, over Meta’s WhatsApp Business Platform. Data processed: the patient’s phone number and name, template fields such as the appointment date and the clinic’s name, delivery status; only if the clinic has enabled this channel and the patient has agreed to be informed through it. Transfer route from Türkiye: the standard contract published by the Board under Article 9(4)(c) KVKK (the module matching the provider’s role) and notification to the Authority; the completion date is published in this line. For clinics in the European Economic Area: the Standard Contractual Clauses.
• Mobile push notifications — the Expo notification infrastructure (650 Industries, Inc., US) and the device platform providers Apple Inc. (Apple Push Notification service) and Google LLC (Firebase Cloud Messaging). Data processed: device notification token, device platform, notification text (summary information such as appointment or payment details and the identifier numbers used to open the record in the application; ordinarily no patient name). Transfer route from Türkiye: the standard contract published by the Board under Article 9(4)(c) KVKK (processor to processor) and notification to the Authority; the completion date is published in this line; onward transfers to the device platform providers follow the onward-transfer terms of that contract. For clinics in the European Economic Area: the Standard Contractual Clauses.
• Support mailbox hosting — Natro (Türkiye). Data processed: the correspondence and attachments sent to [email protected]. Safeguard: within Türkiye; written confidentiality obligation.

4.1. For the processing stated, the following organisations are not sub-processors but controllers in their own right, and their own privacy policies apply:

• Payment institution — iyzi Ödeme ve Elektronik Para Hizmetleri A.Ş. (iyzico, Istanbul, Türkiye; a payment and electronic money institution licensed under Law No. 6493): subscription payments, optional card storage and refunds. Data sent by Clinigim: the clinic name, e-mail, the clinic’s phone number and address, tax or national identity number, IP address, the chosen plan and amount. Card details are entered directly on iyzico’s page and never reach Clinigim; only the transaction result, the card brand, the last four digits and, if the card is saved, the storage key are returned to Clinigim. iyzico processes this data as a controller in its own name; privacy policy: www.iyzico.com/en/privacy-policy. Its infrastructure is in Türkiye.
• Google LLC — only when a user connects Google Calendar with their own account; it acts as a controller in its own right for personal Google accounts and as the clinic’s processor for Google Workspace accounts (Privacy Policy section 9). For the data transferred through this connection, informing data subjects, the legal basis and, where required, the Article 9 KVKK safeguard are the responsibility of the clinic that enables the option (Data Processing Agreement section 11.2).
• Apple Inc. and Google LLC — the app stores through which the mobile application is distributed (controllers in their own right for the store service; sub-processors for notification delivery under section 3).

5.1. Every change to this list is published in the Version history section with its date and content, and clinic owners are informed by e-mail at least 30 days in advance.

Earlier versions of this document and what changed in each:

• 7 November 2026 — Data sent, legal basis and the privacy policy address added to the payment institution entry (section 4).
• 6 November 2026 — Transactional e-mail provider changed: Netlen İnternet Hizmetleri Ltd. Şti. (Türkiye) replaces Brevo (France); this service no longer involves a transfer abroad.
• 6 November 2026 — Application server and database hosting provider changed: Netinternet Bilişim Teknolojileri A.Ş. (Türkiye) replaces Hetzner Online GmbH (Germany).
• 23 October 2026 — Appointment confirmation e-mails added to the transactional e-mail line.
• 20 October 2026 — First publication. The list was previously sent by e-mail on request only.